> ## Documentation Index
> Fetch the complete documentation index at: https://docs.amika.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Secrets

> Scope model, generic vs provider secrets, and the secret command surface.

Amika stores two kinds of secrets in the vault: provider-specific secrets (ie
your Claude or Codex credentials) and generic secrets (anything you set).

This page is the reference — for a walkthrough see [Manage secrets](https://docs.amika.dev/guides/manage-secrets.md).

## Scope model

Generic secrets and extracted secrets carry a scope:

| Scope | Visibility |
| - | - |
| `user` (default) | Private to you |
| `org` | Visible to everyone in your org |

```bash theme={null}
amika secret push API_KEY=sk-... --scope org
```

## `amika secret push`

Push generic secrets from inline arguments, environment variables, or a
`.env` file.

```bash theme={null}
amika secret push ANTHROPIC_API_KEY=sk-ant-xxx
amika secret push --from-env ANTHROPIC_API_KEY,OPENAI_API_KEY
amika secret push --from-file .env
```

| Flag | Default | Description |
| - | - | - |
| `--from-env <keys>` | | Comma-separated env var names to read and push |
| `--from-file <path>` | | Path to a `.env` file with `KEY=VALUE` lines |
| `--scope <scope>` | `user` | `user` (private) or `org` (org-visible) |

When multiple sources are used, positional arguments override `--from-file`
values, and `--from-env` overrides both.

## `amika secret extract`

Discover locally stored credentials and optionally push them to the vault.
See [Local credential discovery](https://docs.amika.dev/reference/auth.md#local-credential-discovery)
for the sources it checks.

```bash theme={null}
amika secret extract
amika secret extract --push
amika secret extract --push --only ANTHROPIC_API_KEY,OPENAI_API_KEY
```

| Flag | Default | Description |
| - | - | - |
| `--push` | `false` | Push discovered secrets after confirmation |
| `--only <keys>` | | Comma-separated names to include |
| `--scope <scope>` | `user` | `user` or `org` |
| `--homedir <path>` | | Override home directory for discovery |
| `--no-oauth` | `false` | Skip OAuth credential sources |

## `amika secret claude` / `amika secret codex`

Manage provider credentials. Both share the same shape; only the provider
segment differs.

### `push`

```bash theme={null}
# Auto-detect OAuth (preferred)
amika secret claude push --type oauth

# API key
amika secret claude push --type api_key --value sk-ant-xxx

# From a file
amika secret codex push --from-file ~/.codex/auth.json
```

| Flag | Default | Description |
| - | - | - |
| `--name <label>` | | Human-readable label (prompted if omitted) |
| `--value <string>` | | Credential value (skips discovery) |
| `--from-file <path>` | | Path to a credentials file (skips discovery) |
| `--type <type>` | `oauth` | `oauth` or `api_key` |

`--value` and `--from-file` are mutually exclusive.

### `list` / `delete`

```bash theme={null}
amika secret claude list           # columns: ID, NAME, TYPE
amika secret claude delete <id>

amika secret codex list
amika secret codex delete <id>
```

## SDK equivalents

```ts theme={null}
// Generic
await client.secrets.create({ name, value, scope });
await client.secrets.list();
await client.secrets.update(id, { value });

// Provider ("claude" or "codex")
await client.agentCredentials.create("claude", { name, value, type: "oauth" });
await client.agentCredentials.list("claude");
await client.agentCredentials.delete("claude", id);
```

See the [client reference](https://docs.amika.dev/sdks/typescript/client.md#secrets) for full
signatures.

## Related docs

* [Manage secrets](https://docs.amika.dev/guides/manage-secrets.md) — task walkthrough
* [Inject credentials](https://docs.amika.dev/guides/inject-credentials.md) — wire secrets into rigs
* [Authentication](https://docs.amika.dev/reference/auth.md) — login and credential discovery
* [config.toml](https://docs.amika.dev/reference/config-toml.md) — `{ secret = "name" }` references


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.